Icon Oncology Group is managing a data breach incident involving unauthorised access to some patient information held on a supplier’s system. At this point in time, it appears it only affects Australia.
The incident involved an externally hosted and managed platform that converts incoming faxes to email. This platform is not Icon’s main system for sending or receiving patient information. It was contained immediately and our core clinical and patient management systems were not affected. All systems are online, secure and patient treatment is not affected.
On becoming aware of the incident, we acted immediately. We activated our incident response plan, reset access to the affected system to prevent any further unauthorised intrusion, and engaged specialist cyber security and forensic advisers to assist in assessing the incident. We have also notified the Australian Federal Police and the relevant regulators.
We have obtained a copy of the impacted records. We are now confirming exactly which patients and what information is involved, and we will contact those patients directly. At this stage, we believe the records do not comprise complete patient files, but rather discrete documents associated with correspondence for our business.
The Group’s systems are secure and operating normally, and patient care and treatment are not affected.
We take the privacy of our patients very seriously and recognise this may be concerning. We will provide further information as it is confirmed.
If you are concerned you may be affected by this breach, and would like to register to receive an update once more information is available, please reach out to us via [email protected]
Last updated: 15 October 2026, 8:15am (AEST)